4 ms·

> For example, in the muller report, a more extensive investigation, the specific hacking unit is identified. How exactly did they arrive at that attribution?

> For example, in the muller report, a more extensive investigation, the specific hacking unit is identified. How exactly did they arrive at that attribution? > Today we know APT-28 was responsible, and they're members of the GRU. How do we know that? No offense, but out of all the places I thought at least people on HN should be aware about the massive caveats that modern-day cyber attribution comes with. The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads. It's something that feels like was generally recognized and agreed on circa a decade ago, but somehow got lost in the flood of sensationalist headlines trying to sell any nmap scan or somewhat noteworthy ransomware infestation as Russia/China/Iran starting cyber world war 3.

joshuamorton 5y ago
I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents. > The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads. No, I'd say people on hn often vastly overstate the lengths people are willing to go to to create these false flag attacks. If we believed hn, no attacks are done, every cyber attack is actually spoofed by an even more formidable spy ring. Sometimes the simplest answer is the right one. The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian. The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia. I'm not sure I can think of any attack where someone tried to successfully frame another nation. This doesn't mean they don't happen, but that they're rare. It also means that if they do happen, they're always successful, which seems unlikely. Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.
- freeflight 5y ago
  > I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents. Why can't you just spell out the method of attribution, instead requiring me to read trough dozens of, mostly political, reports? > The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian. Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public. That's been the reality of the "cyber theater" for decades: It's asymmetric, there's been more than one example of some lone kid on the spectrum, living in their parents basement, pwning very important and advanced national infrastructure at scale. That's why I'm very skeptical when a cyber incident is instantly declared as "state level!", usually that's just part of PR and damage control script, along the lines of: "The adversary was a whole nation state, there's nothing we could have done to prevent this from happening!". Even when the methods deployed are anything but exclusive to nation state actors: Spear-phishing and social engineering are not types of attacks that require nation state resources or knowledge, there's a whole grey market industry offering such attacks as a service. > The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia. Why would that be the only alternative? Your alternative assumes that the attribution to the Russian cyber intelligence is a fact beyond doubt. > I'm not sure I can think of any attack where someone tried to successfully frame another nation. That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. > Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating. As mentioned before: Nobody needs to impersonate a state cyber attack because by now that's the default assumption not just by media but often enough by those affected themselves to cover up for their own InfoSec negligence. "We got pwned by the whole Russian intelligence apparatus using massive resources!" sounds much more impressive, and sympathy inducing ,than "We got pwned by some kid from Ukraine because we don't patch our stuff/one of our employees got phished".
  - joshuamorton 5y ago
    As I understand it, signifiers included command and control servers known to be under Russian state control. So, yes, someone would need to have piggybacked on Russian state controlled servers. > Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public Do you work in this field? I've basically only seen lay people suggest this. > That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on. Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.

joshuamorton 5y ago

I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents. > The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads. No, I'd say people on hn often vastly overstate the lengths people are willing to go to to create these false flag attacks. If we believed hn, no attacks are done, every cyber attack is actually spoofed by an even more formidable spy ring. Sometimes the simplest answer is the right one. The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian. The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia. I'm not sure I can think of any attack where someone tried to successfully frame another nation. This doesn't mean they don't happen, but that they're rare. It also means that if they do happen, they're always successful, which seems unlikely. Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.

freeflight 5y ago
> I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents. Why can't you just spell out the method of attribution, instead requiring me to read trough dozens of, mostly political, reports? > The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian. Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public. That's been the reality of the "cyber theater" for decades: It's asymmetric, there's been more than one example of some lone kid on the spectrum, living in their parents basement, pwning very important and advanced national infrastructure at scale. That's why I'm very skeptical when a cyber incident is instantly declared as "state level!", usually that's just part of PR and damage control script, along the lines of: "The adversary was a whole nation state, there's nothing we could have done to prevent this from happening!". Even when the methods deployed are anything but exclusive to nation state actors: Spear-phishing and social engineering are not types of attacks that require nation state resources or knowledge, there's a whole grey market industry offering such attacks as a service. > The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia. Why would that be the only alternative? Your alternative assumes that the attribution to the Russian cyber intelligence is a fact beyond doubt. > I'm not sure I can think of any attack where someone tried to successfully frame another nation. That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. > Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating. As mentioned before: Nobody needs to impersonate a state cyber attack because by now that's the default assumption not just by media but often enough by those affected themselves to cover up for their own InfoSec negligence. "We got pwned by the whole Russian intelligence apparatus using massive resources!" sounds much more impressive, and sympathy inducing ,than "We got pwned by some kid from Ukraine because we don't patch our stuff/one of our employees got phished".
- joshuamorton 5y ago
  As I understand it, signifiers included command and control servers known to be under Russian state control. So, yes, someone would need to have piggybacked on Russian state controlled servers. > Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public Do you work in this field? I've basically only seen lay people suggest this. > That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on. Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.